Gửi #868925: EnzoVezzaro mcp-dominican-layer Latest Server-Side Request Forgery

## Summary

A Server-Side Request Forgery (SSRF) vulnerability exists in the mcp-dominican-layer MCP server implementation.
The root cause is that the `csvUrl` parameter in the `parse-csv` MCP tool is only validated for basic URL format (`z.string().url()`) and then passed directly to `axios.get()`.
Because there is no destination allowlisting or network boundary validation, the server process can be induced to send HTTP requests to attacker-controlled or internal targets (for example localhost or private network services).

## Details

The MCP server exposes `parse-csv(csvUrl: string)` to fetch and parse CSV content from a remote URL.

Although `z.string().url()` checks URL format via Zod, it does not enforce destination restrictions.

This means attacker-controlled tool input can reach the HTTP request sink directly.

## Vulnerable Code

Version: Latest
File: `src/index.ts`

```ts
server.tool("parse-csv", {
csvUrl: z.string().url()
}, async ({ csvUrl }) => {
try {
const response = await axios.get(csvUrl, { responseType: 'stream' });
const records: any[] = [];
const parser = response.data.pipe(csvParse({
delimiter: ',',
columns: true,
skip_empty_lines: true
}));
for await (const record of parser) {
records.push(record);
}
return {
content: [{ type: "text", text: JSON.stringify(records, null, 2) }]
};
} catch (error: any) {
// ...
}
});
```

Current validation does not restrict:

- destination hostname/domain
- resolved IP range (loopback/private/link-local/metadata)
- destination port
- redirect targets

As a result, attacker-controlled `csvUrl` input reaches the outbound request sink directly.

## Data Flow (source → sink)

1. MCP client invokes `tools/call` for `parse-csv` with attacker-controlled `csvUrl`.
2. MCP server receives `csvUrl` argument in the `parse-csv` handler.
3. Server executes `axios.get(csvUrl, { responseType: 'stream' })`.
4. Outbound request is sent from server network context to attacker-selected destination.
5. Response body is streamed, parsed as CSV, and returned as JSON to the caller (full-read SSRF).

Malicious attackers can inject malicious tool parameters through methods such as prompt/message injection or hijacking MCP client behavior, thereby triggering SSRF.

## Using MCP Inspector (Proof of Concept)

### Prerequisites

- Dependencies installed for mcp-dominican-layer (`npm install && npm run build`)
- MCP Inspector available (`npx @modelcontextprotocol/inspector`)
- Local HTTP listener to capture requests

### Steps

1. Start a local receiver endpoint: python -m http.server 8000


1. Start Inspector with the vulnerable server: npx @modelcontextprotocol/inspector node build/index.js
2. In Inspector:
- Select transport stdio
- Command: `node`
- Args: `build/index.js`
- Click Connect
- Open Tools
- Select parse-csv
- Use payload: http://127.0.0.1:8000/ssrf-test
- Click Run Tool

3. On the local receiver terminal (`python -m http.server 8000`), a new request appears, confirming SSRF.


## Impact

Server-Side Request Forgery (SSRF).

• Nguồn: ⚠️ https://github.com/EnzoVezzaro/mcp-dominican-layer/issues/2
• Người dùng: skywings (UID 98274)
• Đệ trình: 25/06/2026 09:07 (cách đây 2 các tháng)
• Kiểm duyệt: 13/08/2026 16:56 (2 months later)
• Trạng thái: được chấp nhận
• Mục VulDB: 389528 [EnzoVezzaro mcp-dominican-layer đến 39dd373786712650097ad31db27d5c477c8f9c82 parse-csv tool src/index.ts axios.get csvUrl nâng cao đặc quyền]
• điểm: 20